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CLAIMS: 

1 . A method comprising: 

communicating replay data to a plurality of agents coupled to a computing network, 
wherein the replay data includes one or more network packets; and 

issuing commands to the agents to control introduction of the network packets on the 
computing network by the agents. 

2. The method of claim 1 , further comprising: 

generating a set of triggers, wherein each trigger defines one or more conditions; 
communicating the triggers to the agents; 

receiving signals from the agents based on the conditions of the triggers; and 
issuing the commands to the agents in response to the signals. 

3 . The method of claim 2, wherein issuing the commands to the agents in response to 
the signals comprises selectively directing one or more of the agents to introduce the network 
packets upon receiving the signals. 

4. The method of claim 2, wherein generating a set of triggers comprises generating a 
set of triggers based on user input. 

5. The method of claim 1, wherein issuing commands comprises issuing start commands 
to the agents directing the agents to initiate introduction of the network packets on the 
computer network. 

6. The method of claim 1, further comprising: 

associating portions of the replay data with respective agents; 
storing a replay scenario that defines a conditional flow for introduction of the 
portions of the replay data by the agents; and 

issuing the commands to the agents according to the replay scenario. 
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7. The method of claim 6, further comprising receiving input from the user defining the 
replay scenario. 

8. The method of claim 6, wherein associating portions of the replay data with the 

5 respective agents comprises associating portions of the replay data with respective agents in 
response to input received from a user. 

9. The method of claim 1, farther comprising: 
capturing network packets from the network using the agents; and 
selecting portions of the captured network data for use as the replay data. 

10. The method of claim 9, wherein selecting portions of the captured network data 
comprises selecting the portions in response to user input. 

1 1 . The method of claim 9, further comprising: 
communicating the captured network data to an aggregator; 
aggregating the captured network packets into sets of network packets based on 

source information and destination information for the network packets; 
presenting the aggregated network packets to a user; and 

selecting the portions based of the aggregated network packets to use as the replay 
data based on input from the user. 

12. The method of claim 1 1 , wherein aggregating the captured network packets 
comprises: 

25 sorting the network packets based on timestamps of the network packets; 

assigning the network packets having equal source information and equal destination 
information to a common set; and 

identifying within the sets duplicate packets that were captured by different agents. 

30 13. The method of claim 12, wherein sorting the network packets comprises determining 
an originating packet for the duplicate packets. 
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14. The method of claim 12, wherein identifying duplicate packets comprises: 
identifying network packets having equal sequence numbers and acknowledgement 

numbers; and 

performing a byte-by-byte comparison for payloads of the identified packets. 

15. The method of claim 1 1, wherein the source information comprises one of a media 
access control (MAC) address and a Data Link Control (DLC) address for a source network 
device. 

1 6. The method of claim 1 1 , wherein the destination information comprises one of a 
media access control (MAC) address and a Data Link Control (DLC) address for a 
destination network device. 

1 7. The method of claim 1 , further comprising: 
modifying the replay data based on user input; and 
communicating the modified replay data to agents. 

18. The method of claim 1 7, further comprising modifying the replay data based on user 
input. 

19. The method of claim 17, further comprising introducing the respective network 
packets of the replay data with the agents. 

20. The method of claim 19, wherein introducing the respective network packets 
comprises modifying sequence numbers and acknowledgement numbers of the packet to 
simulate authentic network activity. 

21. A method comprising: 
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storing replay data that includes network packets and that defines a conditional flow 
for introduction of portions of the replay data by respective agents coupled to a computing 
network; 

communicating portions of the replay data to the respective agents; and 
5 issuing commands to the agents to control introduction of the network packets on the 

computing network by the agents. 

22. The method of claim 2 1 , further comprising: 
receiving signals from the agents indicative of network events; and 
issuing the commands to the agents in response to the signals and in accordance with 

the replay scenario. 

23 . The method of claim 2 1 , further comprising: 
generating a set of triggers, wherein each trigger defines one or more conditions; 
communicating the triggers to the agents; 

receiving signals from the agents based on the conditions of the triggers; and 
issuing the commands to the agents in response to the signals and in accordance with 
the replay scenario. 

24. The method of claim 23 , wherein issuing the commands to the agents comprises 
selectively directing one or more of the agents to introduce the respective portions of the 
network packets upon receiving the signals. 

25. The method of claim 2 1 , further comprising: 

25 capturing network packets from the network using the agents; and 

selecting portions of the captured network packets for use as the replay data. 

26. The method of claim 25, wherein selecting portions of the captured network portions 
comprises selecting the portions in response to user input. 

30 

27. The method of claim 25, further comprising: 
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communicating the captured network data to an aggregator; 
aggregating the captured network packets into sets of network packets based on 
source information and destination information for the network packets 
presenting the aggregated network packets to a user; and 

selecting the portions based of the aggregated network packets to use as the replay 
data based on input from the user. 

28. The method of claim 27, wherein aggregating the captured network packets 
comprises: 

sorting the network packets based on timestamps of the network packets; 
assigning the network packets having equal source information and equal destination 
information to a common set; and 

identifying within the sets duplicate packets that were captured by different agents. 

29. A system comprising: 

a plurality of distributed agents coupled to a computing network; and 
a replay module coupled to the network to communicate to the agents replay data that 
includes one or more network packets, wherein the replay module issues commands to the 
agents to control introduction of the network packets on the computing network by the 
agents. 

30. The system of claim 29, further comprising a storage medium to store a set of 
triggers, wherein each trigger defines one or more conditions, and further wherein the replay 
agent: 

communicates the triggers to the agents; 

receives signals from the agents based on the conditions of the triggers; and 
issues the commands to the agents in response to the signals.. 

3 1 . The system of claim 30, wherein the replay module selectively directs one or more of 
the agents to introduce the respective network packets upon receiving the signals. 
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32. A system comprising: 

a plurality of distributed agents coupled to a computing network; 

a replay module coupled to the network having a storage medium to store replay data 
that includes network packets and defines a conditional flow for introduction of the replay 
data by the agents, wherein the replay module communicates portions of the replay data to 
the agents, and issues commands to the agents according to the conditional flow to control 
introduction of the network packets on the computing network by the agents. 

33. The system of claim 32, further comprising a communication link coupling the agents 
to the replay module, wherein the replay module receives signals from the agents via the 
communication link indicative of network events, and further wherein the replay module 
issues the commands to the agents via the communication link in response to the signals and 
in accordance with the replay scenario. 

34. The system of claim 32, wherein the storage medium stores a set of triggers, wherein 
each trigger defines one or more conditions, and further wherein the replay module: 

communicates the triggers to the agents; and 

receives signals from the agents based on the conditions of the triggers; and 
issues the commands to the agents in response to the signals and in accordance with 
the replay scenario. 

35. The system of claim 32, further comprising an aggregation module coupled to the 
network to receive packets captured from the network by the agents. 

36. The system of claim 35, wherein the aggregation module aggregates the captured 
network packets into sets of network packets based on source information and destination 
information for the network packets. 

37. The system of claim 36, further comprising a user interface to present the aggregated 
network packets to a user, and to select portions of the aggregated network packets to use as 
the replay data based on input from the user. 
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38. The system of claim 37, wherein the aggregation module identifies duplicate packets 
that were captured by different agents, and presents the non-duplicate network packets on the 
user interface. 

39. A medium comprising instructions to cause a processor to: 

communicate replay data to a plurality of agents coupled to a computing network, 
wherein the replay data includes one or more network packets; and 

issue commands to the agents to control introduction of the network packets on the 
computing network by the agents. 

40. The medium of claim 39, further comprising instructions to cause the processor to: 
generate a set of triggers, wherein each trigger defines one or more conditions; 
communicate the triggers to the agents; 

receive signals from the agents based on the conditions of the triggers; and 
issue the commands to the agents in response to the signals. 

41 . The medium of claim 40, wherein the instruction cause the processor to selectively 
direct one or more of the agents to introduce the respective network packets upon receiving 
the signals. 

42. The medium of claim 39, wherein the instruction cause the processor to: 
associate portions of the replay data with respective agents; 

store a replay scenario that defines a conditional flow for introduction of the portions 
of the replay data by the agents; and 

issue the commands to the agents according to replay scenario. 

43. The medium of claim 39, further comprising instructions to cause the processor to: 
direct the agents to capture packets from the network; and 

select portions of the captured network data for use as the replay data. 
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44. The medium of claim 43, further comprising instructions to cause the processor to 
aggregate the captured network packets into sets of network packets based on source 
information and destination information for the network packets. 

45. The medium of claim 44, further comprising instructions to cause the processor to 
sort the network packets based on timestamps of the network packets, assign the network 
packets having equal source information and equal destination information to a common set, 
and identify within the sets duplicate packets that were captured by different agents. 
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